Networks

Ask something
Question Locked

One user Sending out mass spam

0 helpful
15 replies

by ryan1234bishop

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Server 2003 running exchange 2003
the Client has XP running office 2007

I have one Client sending out about 10 spam messages an hour automatically. No one else that uses that server is having this issue.
I assumed he had some sort of virus on his PC so I formatted it but even after the format the spam is still sending out

I did multiple scans on the server with malware bytes, super anti spy ware, mcafee and the cleaner 2011 and found 0 infections on the server

has anyone had this experienced before with a spam sending virus only effecting one user? How Do I deal with this if multiple scanners are not picking up any infections?

Thanks
Ryan

15 replies

by tobif

Are these messages sent via via Exchange or smtp? Do you have any clues in the headers of the messages? Are the outgoing messages saved in the users "Sent" folder?

It could be a macro in an office document or template. It could be any application calling a MAPI handle. It could be a funny javascript on his favorite site...
(Does he have any web-pages constantly open in a browser or gadget?)

Do these mails have so much in common that you can trap them on the server, and maybe automatically alert the user. That could give him a clue to what kind of his activities would trigger the sending of a mail.

by ryan1234bishop

First off thanks for the reply :)

As of right now I don't have the messages in front of me but from what I saw is that the spam was sending out random messages to the clients domain to E-mail addresses that dont exist.
(example the clients email is bob@mboc.ca and the spam is getting sent to mary@mboc.ca and tom@mboc.ca yet there are no mary or tom addresses on the exchange)

and as for the macro or funny java script I know its not client computer biased because I completely formatted the PC and when I did his first send/receive after outlook was reinstalled spam was coming in dated 2 days ago when his computer was in my shop getting serviced

and as for the mail having things in coming I am now getting him to FW me a few so I can take a closer look

Cheers
Ryan

by kenone

If that's the case it's not on your system at all. Someone is just spoofing the user as the senders address.

by tobif

I was thinking about this, as well. That's why I asked how he has noticed the spam.

All right. Then I'm off to the gym. See ya!

by ryan1234bishop

The client just sent me some of the spam here is an example of one

From: System Administrator
Sent: Friday, September 10, 2010 3:12 PM
To: James Reid
Subject: Undeliverable: Get your normal hormones level back to your body.
Your message did not reach some or all of the intended recipients.
Subject: Get your normal hormones level back to your body.
Sent: 9/10/2010 3:12 PM
The following recipient(s) cannot be reached:
bobbycherry3@mboc.ca on 9/10/2010 3:12 PM
The e-mail account does not exist at the organization this message was sent to. Check the e-mail address, or contact the recipient directly to find out the correct address.

Note that the bobbycherry3@mboc.ca account does not exist on the server

by darryl~

Are you aware of any emails that have been sent to external addresses?

And just another thought on the "spoofing"....is there any chance that another computer in the domain is infected & has spoofed his email account?

If your network isn't very big (the website says you only have a staff of 6) than maybe it might be worth scanning all the computers for spyware/viruses.

PS - How's things over on the Rock? My son attends MUN over there, he enjoys NL.

by ryan1234bishop

I have a sonciwall onsite as their gateway with gateway AV on it

I am going to reset the logs and check it monday

Thanks for the help guys
I am off for the weekend!

by tobif

Much more interesting are the hidden headers. (There you have at least some information that can't be spoofed.)

A typical email message will have spoofed sender address, may indicate a different recipient than the address actually sent to (and, most of all, you shouldn't believe the body text, of course.)

The hidden fields may have additional ip addresses added, to make it harder to guess, from where it really was sent, but at least you will see which ip-address handed the message to the last server. If this ip-address is in your network, then you know where to look for an infected computer. If the ip is outside your network, then you can relax a bit.

by darryl~

website has an email form to contact them (email addresses are also listed on the site)....that can cause issues if not set up proper.

by ryan1234bishop

I checked my security logs today on the fire wall and a IP Spoof keeps getting dropped

its coming from an IP that is not even in the DHCP list and its going through port 161

by ryan1234bishop

Microsoft Mail Internet Headers Version 2.0
From: postmaster@mboc.ca
To: hiPharmacyCanada11@yahoo.com
Date: Mon, 13 Sep 2010 11:37:48 -0230
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="9B095B5ADSN=_01CB2F2C8AC0700800020FB6mail.mboc.ca"
X-DSNContext: 335a7efd - 4523 - 00000001 - 80040546
Message-ID:
Subject: Delivery Status Notification (Failure)

--9B095B5ADSN=_01CB2F2C8AC0700800020FB6mail.mboc.ca
Content-Type: text/plain; charset=unicode-1-1-utf-7

--9B095B5ADSN=_01CB2F2C8AC0700800020FB6mail.mboc.ca
Content-Type: message/delivery-status

--9B095B5ADSN=_01CB2F2C8AC0700800020FB6mail.mboc.ca
Content-Type: message/rfc822

Received: from net43.186.188-25.tmn.ertelecom.ru ([188.186.43.25]) by mail.mboc.ca with Microsoft SMTPSVC(6.0.3790.4675);
Mon, 13 Sep 2010 11:37:46 -0230
Received: by net43.186.188-25.tmn.ertelecom.ru id hgfdu66bee3s for ; Tue, 14 Sep 2010 20:12:37 +0500 (envelope-from )
Message-ID: <82461568.8836530368900.JavaMail.root@mx11.S69124lpqym$$$>
Date: Tue, 14 Sep 2010 20:12:37 +0500
From:
Reply-To: hiPharmacyCanada11@yahoo.com
To: jmurphy@mboc.ca
Subject: hello member
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Return-Path: hiPharmacyCanada11@yahoo.com
X-OriginalArrivalTime: 13 Sep 2010 14:07:47.0704 (UTC) FILETIME=[0B47E780:01CB534D]

--9B095B5ADSN=_01CB2F2C8AC0700800020FB6mail.mboc.ca--

by tobif

1. This particular sample is a non-delivery notification for a spam message that was sent from a Russian computer. You're not guilty.

2. However, the claimed original sender address is spoofed. It may still belong to the evil spammering guys, but the mail was not sent via Yahoo servers.

I'd suggest that you tell your mail server to stop sending "failed delivery notifications" for mail that originate outside your own domain.
This to avoid your network being used as a bouncing field for indirect spam.

If spam is becoming a problem, you might also consider having your server to check ip-addresses from which you receive incoming emails against some black lists. That should stop at least some botnet mailings.

by ryan1234bishop

I May be speaking a but prematurely but I think with all your help I solved it

I looked at the property's of the SMTP server and for some reason the user who was getting theses non delivery spam messages was listed in the "send a copy of the NDR to:" box

so needless today I removed him from it and now monitoring his inbox

by tobif

Now that you've sorted this out (Hopefully).
Walk through your posts and distort logs and headers with regards to email addresses and your domain name. No need to leave too big traces for spiderbots to pick up from here.

Afterwards, suggest your clients think one round more about what addresses they publish on the site. Maybe they should cut back to a few emails, specifically intended for public use?
If at all needed, for specific people's addresses, they could use a way that would be understood by people, but not bots. ("lastname.firstname.initial@" etc). Some sites convert addresses into pictures, which is not nice for visually impaired users, though. If you do that, you must refrain from adding a mailto link, since that is even easier for a bot to pick up, even if it's not seen on the page itself.

This discussion is closed to new replies.